An updated RealPlayer package that fixes a buffer overflow bug is now available for Red Hat Enterprise Linux Extras 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

RealPlayer is a media player that provides media playback locally and via streaming.

A buffer overflow bug was discovered in the way RealPlayer processes Flash Media (.swf) files. It is possible for a malformed Flash Media file to execute arbitrary code as the user running RealPlayer. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0323 to this issue.

All users of RealPlayer are advised to upgrade to this updated package, which contains RealPlayer version 10.0.7 and is not vulnerable to this issue.

Secunia Advisories Reports :

A boundary error when processing SWF files can be exploited to cause a buffer overflow. This may allow execution of arbitrary code on the user's system.

According to its version number, the installed version of Rhapsody on the remote host suffers from a buffer overflow involving SWF files. To exploit this issue, a remote attacker needs to convince a user to attempt to play a maliciously crafted SWF file using the affected application.

バッファオーバーフローのバグを修正する更新済みの RealPlayer パッケージが、Red Hat Enterprise Linux 3 および 4 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新には重大なセキュリティインパクトがあるものとして評価しています。

RealPlayer は、ローカルやストリーミングによるメディアのプレイバックを可能にするメディアプレイヤーです。

RealPlayer が Flash Media（.swf）ファイルを処理する方法で、バッファオーバーフローのバグが発見されました。無効な形式の Flash Media ファイルが、RealPlayer を実行しているユーザーとして任意のコードを実行する可能性があります。Common Vulnerabilities and Exposures プロジェクトは、この問題に CVE-2006-0323 という名前を割り当てました。

RealPlayer の全ユーザーは、こRealPlayer のバージョン 10.0.7 が含まれるこの更新済みパッケージへアップグレードし、この問題に対しての脆弱を解決することが推奨されます。

更新后的 RealPlayer 程序包修复了一个缓冲区溢出缺陷，现在可用于 Red Hat Enterprise Linux 3 和 4。

Red Hat 安全响应团队将此更新评级为具有严重安全影响。

RealPlayer 是一款提供本地媒体播放和流媒体播放的媒体播放器。

在 RealPlayer 处理 Flash Media (.swf) 文件的方式中发现一个缓冲区溢出缺陷。畸形 Flash Media 文件可能以运行 RealPlayer 的用户的身份执行任意代码。通用漏洞和暴露计划为此问题分配了名称 CVE-2006-0323。

建议所有 RealPlayer 用户升级此更新后的程序包，其中包含 RealPlayer 版本 10.0.7，不易受到此问题的影响。

現已提供適用於 Red Hat Enterprise Linux Extras 3 和 4 的更新版 RealPlayer 套件，可修正一個緩衝區溢位錯誤。

Red Hat 安全性回應團隊已將此更新評等為具有重大安全性影響。

RealPlayer 是一種媒體播放程式，可於本機及透過資料流播放媒體。

在 RealPlayer 處理 Flash Media (.swf) 檔案的方式中發現一個緩衝區溢位錯誤。格式錯誤的 Flash Media 檔案可以執行 RealPlayer 的使用者身分執行任意程式碼。Common Vulnerabilities and Exposures 專案已將名稱 CVE-2006-0323 指派給此問題。

建議所有 RealPlayer 使用者皆升級至此更新版套件，其中包含 RealPlayer 10.0.7 版，且不受此問題影響。

The remote host is affected by the vulnerability described in GLSA-200603-24 (RealPlayer: Buffer overflow vulnerability)

    RealPlayer is vulnerable to a buffer overflow when processing     malicious SWF files.
  Impact :

    By enticing a user to open a specially crafted SWF file an     attacker could execute arbitrary code with the permissions of the user     running the application.
  Workaround :

    There is no known workaround at this time.

According to its build number, the installed version of RealPlayer / RealOne Player / RealPlayer Enterprise on the remote Windows host suffers from one or more buffer overflows involving maliciously- crafted SWF and MBC files as well as web pages.  In addition, it also may be affected by a local privilege escalation issue.

The installed version of RealPlayer / RealOne Player / RealPlayer Enterprise for Windows on the remote host is prone to buffer overflow and heap overflow vulnerabilities.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host subject to the permissions of the user running the affected application.  Note that a user doesn't necessarily need to explicitly access a malicious media file since the browser may automatically pass RealPlayer skin files (ie, files with the extension '.rjs') to the application.

The installed version of RealPlayer on the remote host is prone to buffer overflow vulnerabilities.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host subject to the permissions of the user running the affected application.  Note that a user doesn't necessarily need to explicitly access a malicious media file since the browser may automatically pass the file to the RealPlayer application. 

According to its banner, the version of iTunes for Windows on the remote host launches a helper application by searching for it through various system paths.  An attacker with local access can leverage this issue to place a malicious program in a system path and have it called before the helper application.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
63831	RHEL 3 / 4 : RealPlayer (RHSA-2006:0257)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
21402	FreeBSD : linux-realplayer -- buffer overrun (25858c37-bdab-11da-b7d4-00123ffe8333)	Nessus	FreeBSD Local Security Checks	2006/5/13	2021/1/6	high
21141	Rhapsody SWF File Handling Buffer Overflow	Nessus	Windows	2006/3/24	2018/8/22	high
63831	RHEL 3 / 4：RealPlayer（RHSA-2006:0257）	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
63831	RHEL 3 / 4：RealPlayer (RHSA-2006:0257)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
63831	RHEL 3 / 4 : RealPlayer (RHSA-2006:0257)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
21148	GLSA-200603-24 : RealPlayer: Buffer overflow vulnerability	Nessus	Gentoo Local Security Checks	2006/3/27	2021/1/6	high
21140	RealPlayer for Windows < Build 6.0.12.1483 Multiple Vulnerabilities	Nessus	Windows	2006/3/24	2018/7/25	high
3286	RealPlayer for Windows Multiple Overflows (2)	Nessus Network Monitor	Web Clients	2005/11/11	2019/3/6	medium
3485	RealPlayer for Linux, Mac, and Windows Remote Overflows	Nessus Network Monitor	Web Clients	2006/3/23	2019/3/6	medium
3296	iTunes For Windows < 6.0 Local Code Execution	Nessus Network Monitor	Web Clients	2005/11/16	2019/3/6	medium

检测

插件搜索

high

high

high

high

high

high

high

high

medium

medium

medium